Zero Trust Security
Implementation Guide

The traditional "castle-and-moat" security model — trust everything inside the network perimeter, block everything outside — is fundamentally broken in the modern enterprise. Remote workers access resources from home networks and coffee shops. Applications live in AWS, Azure, and SaaS platforms, not in the datacenter. Contractors, partners, and vendors need access to specific systems without joining the corporate network.

Zero Trust replaces perimeter trust with a simple principle: never trust, always verify — every access request is authenticated, authorized, and continuously validated regardless of where it originates. This guide walks through implementing Zero Trust systematically, starting with the identity foundation and progressing through device trust, network segmentation, ZTNA, and behavioral analytics.

1 Zero Trust Principles & Pillars

Zero Trust is not a single product — it is a security philosophy implemented across six technology pillars. NIST SP 800-207 defines the authoritative Zero Trust Architecture framework that this guide follows. Each pillar addresses a different trust assumption that traditional security models make incorrectly.

Zero Trust vs Traditional Security

2 Zero Trust Maturity Assessment

The CISA Zero Trust Maturity Model defines five maturity levels across the six pillars — Traditional, Initial, Advanced, and Optimal. Most organizations begin at Traditional or Initial. Understanding your current position across each pillar determines where to invest first.

Self-Assessment — Rate Your Current Posture

3 Identity & MFA Foundation

Identity is the cornerstone of Zero Trust — every other control depends on reliably knowing who is making an access request. Deploying strong MFA and centralized identity management is the single highest-impact Zero Trust investment for most organizations.

MFA Method Security Ranking

Azure AD Conditional Access — Zero Trust Policies

4 Device Trust & Posture Validation

In Zero Trust, a valid username and password is not sufficient for access — the device making the request must also prove it meets security requirements. An attacker who steals credentials from a compromised personal device should still be blocked if that device is not compliant with your security baseline.

Microsoft Intune Device Compliance Policies

Certificate-Based Device Authentication

5 Micro-Segmentation

Micro-segmentation replaces flat, trusted internal networks with isolated segments where even internal traffic requires explicit authorization. It is the primary control that limits lateral movement — preventing an attacker who compromises one system from freely moving to others.

Segmentation Strategy

1. Map all internal traffic flows: Before segmenting, document which systems talk to which — application servers to databases, clients to file servers, monitoring to all devices. Segmentation without traffic maps causes application outages
2. Define security zones: Group systems by sensitivity and function — not just by team or department. The key zones are: User endpoints, Servers (web tier, app tier, DB tier), Management (monitoring, jump servers, AD), IoT/OT devices, DMZ (internet-facing), Guest
3. Apply deny-all between zones by default: No inter-zone traffic unless explicitly permitted by firewall policy — this is the opposite of the current state for most organizations
4. Implement application-aware policies: Where possible, use application-layer (Layer 7) rules — allow "ERP application traffic from app servers to DB servers" rather than "any TCP from 10.10.2.0/24 to 10.10.3.0/24"
5. Protect east-west traffic: Deploy internal firewalling between server segments — FortiGate internal segmentation firewall, or VMware NSX for virtualized environments

FortiGate Micro-Segmentation Implementation

6 ZTNA Deployment — FortiGate & Azure

Zero Trust Network Access (ZTNA) replaces traditional VPN with per-application, identity-verified access. Instead of granting users full network access through a VPN tunnel, ZTNA brokers individual application connections — users can only reach the specific applications they are authorized for, nothing else.

ZTNA vs Traditional VPN

FortiGate ZTNA Configuration

Azure AD Application Proxy — ZTNA for On-Premises Apps

7 Least Privilege & PAM

Least privilege means every user, service account, and application has only the minimum permissions required to do their job — and nothing more. Privileged Access Management (PAM) extends this to administrator accounts, which represent the highest-value targets for attackers.

Least Privilege Implementation Steps

1. Audit existing permissions: Export all role assignments from Active Directory, Azure RBAC, and AWS IAM — identify over-privileged accounts, stale permissions, and accounts with Domain Admin or Global Admin that do not need it
2. Separate admin and user accounts: Every IT staff member with admin duties must have two accounts — a standard user account for daily work (email, browsing) and a separate privileged account used only for administrative tasks
3. Implement Just-In-Time (JIT) access: Privileged roles are not permanently assigned — staff request elevated access when needed, it is granted for a defined time window (1–8 hours), then automatically revoked
4. Deploy PAM solution: Azure PIM (Privileged Identity Management) for cloud roles, CyberArk / BeyondTrust / Delinea for on-premises admin accounts — PAM vaults admin credentials, session-records all privileged activity, and enforces approval workflows
5. Service account hygiene: Audit all service accounts — remove unnecessary privileges, set strong passwords, enable auditing. Replace static service account passwords with Managed Service Accounts (gMSA) where possible
6. Review quarterly: Access creep is real — run quarterly access certification campaigns where managers confirm their team members still need every permission assigned

Azure PIM — JIT Admin Access

8 Continuous Monitoring & Analytics

Zero Trust is not a one-time configuration — it requires continuous monitoring of identity signals, device health, network traffic, and application behavior to detect anomalies that indicate compromised accounts, insider threats, or policy violations in real time.

Zero Trust Monitoring Stack

• Microsoft Sentinel (SIEM): Ingest Azure AD sign-in logs, Intune device compliance events, FortiGate firewall logs, and M365 audit logs into a unified SIEM — enables cross-pillar threat correlation that individual tools cannot provide
• Azure AD Identity Protection (UEBA): Machine learning-based detection of risky sign-ins — impossible travel, sign-in from TOR, password spray, anomalous token patterns. Auto-remediates by requiring MFA or blocking based on risk score
• Microsoft Defender for Cloud Apps (CASB): Monitors all SaaS application activity — detects mass download, unusual admin activity, sharing with external domains, and shadow IT application usage
• FortiAnalyzer + FortiSIEM: On-premises SIEM for FortiGate log aggregation — correlates firewall events, ZTNA access logs, and endpoint security alerts into unified incident views
• Network Traffic Analysis (NTA): Deploy Darktrace, Vectra, or ExtraHop for behavioral network analytics — detects east-west lateral movement, beaconing to C2 servers, and data exfiltration patterns that signature-based tools miss
• User and Entity Behavior Analytics (UEBA): Establish normal baseline for each user's access patterns — alert when behavior deviates significantly (new country login, first-time access to sensitive data, bulk file downloads)

Key Zero Trust Metrics to Track